CVE-2017-7760

2018-06-1100:00:00

ubuntu.com

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.5%

JSON

The Mozilla Windows updater modifies some files to be updated by reading
the original file and applying changes to it. The location of the original
file can be altered by a malicious user by passing a special path to the
callback parameter through the Mozilla Maintenance Service, allowing the
manipulation of files in the installation directory and privilege
escalation by manipulating the Mozilla Maintenance Service, which has
privileged access. Note: This attack requires local system access and only
affects Windows. Other operating systems are not affected. This
vulnerability affects Firefox ESR < 52.2 and Firefox < 54.